Do you know the supply chain risk your Helm charts carry?
· 7 min read
Do you even know the supply chain risk your Helm charts carry? I bet you don't.
MongoDB Passwordless Authentication on Azure AKS using Workload Identity
· 9 min read
best bet, you are still not rotating your DB passwords and tokens across your infra, but if the software integrations you use, has a stable passwordless option, i think you shouldnt keep a static credentials option then?
AKS + Karpenter: kubectl logs returns 401 Unauthorized
· 6 min read
kubectl get pods is fine. kubectl describe is fine. Then you hit kubectl logs on a pod that just landed on a Karpenter node and get 401 Unauthorized. Same cluster. Same context. Pods on the system pool still give you logs. That split is the smell.
Self-hosted Karpenter on AKS: Cilium, CAS, and the quota wall
· 7 min read
On EKS, "run Karpenter" is mostly: chart, IRSA, NodePool, EC2NodeClass. On AKS the same sentence hits a wall of prerequisites Microsoft already documented. Then a quieter wall nobody puts in the getting-started: regional vCPU quota.
The Incident Response Step Most Teams Skip: Memory Forensics for Kubernetes
· 13 min read
Your audit logs are quiet. Falco did not fire. The pod filesystem looks clean. And the threat actor is still in the cluster.
Container Image SBOM Blind Spots: What Scanning Your Image Still Misses
· 15 min read
Every container security program ends up doing the same three things: scan the image with Trivy in CI, sign it with cosign, put up a dashboard that counts CVEs. Then they call the problem "in progress."
That checklist is the easy 20% of the work. It makes a lot of noise but cuts very little risk.
GitHub Actions Supply Chain Attacks: How to Actually Harden Your CI/CD Pipeline
· 10 min read
Your team has pinned every third-party action to an immutable SHA. Runners are GitHub-hosted, ephemeral, isolated. Someone ran zizmor once and filed a ticket. The posture feels done.
Kubernetes Runtime Security: The Silence That Should Keep You Up at Night
· 13 min read
On an engagement I worked alongside Olakojo testing a product. Between Ola is one of the best offensive security engineers in this space, and watching him work is a lesson in patience: he does not spray exploits and hope. He reads the app, finds the innocent looking path, and walks in through the front door everyone believed was secure.
GitHub Access Control at Scale: Why IaC Beats Entra Groups and Manual Grants
· 17 min read
A Reddit thread on r/devops stuck with me: someone at a 600-developer org with 2,000 repositories, Okta pushing users via SCIM, was redesigning RBAC and asking whether GitHub teams could realistically be managed with IaC. The replies split fast: Entra groups, access-request tickets, safe-settings, Terraform, and one blunt take: "Don't. Unless you have a full team of Terraform experts."
Building a Kubernetes IR Playbook: Audit Logs Alone Won't Save You
· 20 min read
If you stay in this space long enough, you'll one day face real incident before you retire, pivot, or quietly stop answering pages. Dont let it catch you off guard, compose and face it, haha, its your turn.